topic Re: Application ID's in General Topics

Application ID's

skobel — Tue, 06 Oct 2020 19:23:49 GMT

Recently Cisco WebEx deployed a software update and it changed enough so the Palo Alto could NOT recognize the application ID as being webex, causing an impact to our client.

So my question is, is there anyway to determine if a software update for any vendor will cause the application ID to NOT recognize the application after the update?

Re: Application ID's

MP18 — Tue, 06 Oct 2020 21:18:25 GMT

@skobel

To check what impact of any application update by the vendor for that you can check Release Notes for the Applications under

Device

Dynamic updates.

This is for new application signature update by the Palo Alto.

In your case PA need to update their application signature to correctly identify the application.

Sometimes i have seen that we need to create PCAP and send to PA so that they can create application signature.

Regards

Re: Application ID's

ethiSEC — Wed, 07 Oct 2020 05:37:27 GMT

There's always a chance that something will break with App-ID if a vendor changes things on their side as I'm pretty sure they don't ring each NGFW vendor and say here are the changes to our app, better modify your application signature.

On occasion, PAN will be aware of the changes and will make a note of upcoming changes in the weekly release notes. If you don't receive the release notes via email I'd suggest you add them to your profile as they can help minimise App-ID related issues, provided you keep tabs on documented changes.

Re: Application ID's

OtakarKlier — Wed, 07 Oct 2020 19:43:10 GMT

Hello,

Also make sure your PAN;s are performing dynamic updates on a regular basis. This helps make sure that when the new app id's are released, the PAN will install them automatically.

Just make sure to put timers on them so they dont install immediately encase there is a issue with one, rare but does happen: